vCISO Services

Flow chart of the vCISO engagement, 5 phases in order, each one selectable. Phase 1, Assessment. We review your current security posture, risks, controls and obligations, and benchmark them against a recognised framework so we all start from the same clear picture. Activities: Score current controls against the NIST CSF functions; Interview technology, legal and operations leads; Build or refresh the risk register with owners; Review contractual and regulatory obligations you carry. Hands over Security Posture Assessment. Phase 2, Strategy and Roadmap. We build a prioritised roadmap tied to your business goals and risk appetite, so every investment has a reason and a sequence. Activities: Set risk appetite with your leadership team; Sequence initiatives across the next four quarters; Size budget and headcount for each initiative; Agree the metrics that will show progress. Hands over Security Roadmap and Board Pack. Phase 3, Programme Execution. We work with your team to deliver the roadmap, standing up policies, controls and processes, and keeping momentum between our sessions. Activities: Draft and approve the policy set with control owners; Run the delivery cadence and unblock stalled work; Roll out priority controls such as MFA and logging; Track roadmap progress against the agreed metrics. Hands over Policy and Control Framework. Phase 4, Board and Stakeholder Reporting. We translate security into business language for your board, customers and auditors, and represent your programme with credibility when it counts. Activities: Prepare the quarterly board update on risk and progress; Answer customer security questionnaires and due diligence; Represent your programme to auditors and regulators; Brief executives before renewals and major deals. Hands over Board and Stakeholder Reporting Pack. Phase 5, Continuous Advisory. We stay available for the decisions that come up between milestones, from a new vendor to a security incident to a customer's due diligence. Activities: Review new vendors and architecture changes before sign-off; Advise on live incidents and escalation decisions; Support contract and security clause negotiation; Hold a standing call with your technology leads. Hands over Advisory Notes and Decision Records. Each phase begins from the artefact the phase before it produced.